Fix Teams Safe Link Warning Blocks a Valid URL in Teams Admin Center

When you paste a legitimate URL into a Teams message, Teams may display a Safe Links warning and block the link. This happens because Microsoft Defender for Office 365 scans every link in Teams chat and channels. The warning appears even if the URL is safe, often due to a misconfigured Safe Links policy. This article explains why the block occurs and how to fix it in the Teams admin center so your valid URLs go through without interruption.

The fix involves adjusting the Safe Links policy settings and, if needed, adding the domain to an allow list. You will also learn how to verify the policy applies to your users and how to handle related failures like false positives on internal links.

Why Teams Safe Links Blocks a Valid URL

Safe Links is a feature of Microsoft Defender for Office 365. It scans URLs in Teams messages and meetings before users click them. When you paste a link, Teams sends the URL to the Safe Links service. The service checks the domain against threat intelligence and your organization’s policies. If the URL appears suspicious, Teams shows a warning and blocks the click.

The block can happen for a valid URL for several reasons. The domain may have a low reputation score. The URL may contain a redirect that Safe Links flags. Your Safe Links policy might be set to block URLs that are not re-scanned on every click. Or a user may have manually reported the domain as malicious.

The most common cause is a policy setting that is too strict. The default Safe Links policy applies to all users. It blocks URLs that contain a semicolon or an equal sign. It also blocks URLs that are not re-written to point to the Safe Links service. These settings are safe for most cases, but they can cause false positives for legitimate internal links or links with query parameters.

Prerequisites to Fix Safe Links in Teams

Before you change any settings, confirm you have the right permissions. You need to be a global administrator or a security administrator in Microsoft 365. You also need access to the Microsoft 365 Defender portal, not just the Teams admin center. Safe Links policies are managed in Defender, while Teams admin center shows the results.

Also verify that your organization has a Microsoft 365 E5 or E5 Security license. Safe Links is included in these plans. If you only have Microsoft 365 Business Standard, you cannot use Safe Links. In that case, the warning may come from a different security feature, such as an anti-phishing policy.

Steps to Fix Safe Links Warning for a Valid URL

Follow these steps to stop Teams from blocking a valid URL. The process involves editing the Safe Links policy and adding the domain to the allow list.

1. Open the Microsoft 365 Defender portal
   Go to security.microsoft.com and sign in with your admin account. Select Email & collaboration from the left navigation, then choose Policies & rules. Click Threat policies and then select Safe Links from the list.
2. Identify the Safe Links policy that applies
   You will see a list of policies. The default policy is named Default (Office 365). If your organization has custom policies, check which one applies to the affected user. You can see the policy assignment under the Users tab in the Teams admin center, but the policy settings are edited here.
3. Edit the Safe Links policy
   Click the policy name to open its details. In the URL and click protection settings section, review the options. For a valid URL that is blocked, you may need to change two settings. First, uncheck Block the following URLs if your URL matches one of those patterns. Second, uncheck Do not track user clicks if you want to allow clicks without tracking.
4. Add the domain to the allow list
   In the same policy, scroll to Allow list. Click Add and enter the domain of the blocked URL. For example, if the blocked URL is contoso.sharepoint.com, add contoso.sharepoint.com. Do not use wildcards. Save the policy.
5. Test the URL in Teams
   Wait about 30 minutes for the policy to propagate. Then paste the same URL in a Teams chat. The warning should not appear. If it still appears, check the tenant allow/block list in the next section.

Add the URL to the Tenant Allow/Block List

If editing the policy does not work, add the URL to the tenant allow/block list. This list overrides all Safe Links policies.

1. Go to the Tenant Allow/Block List
   In the Microsoft 365 Defender portal, select Policies & rules > Threat policies > Tenant Allow/Block Lists.
2. Add an allowed URL
   Click the URLs tab, then click Add. Enter the exact URL that is blocked. You can also add the domain by selecting Domains tab. Set the expiration to Never if you want the rule to stay permanently.
3. Save and verify
   Click Add and then Done. Wait 30 minutes and test the link in Teams again.

If Teams Still Shows the Safe Links Warning

Teams Shows a Warning for an Internal SharePoint Link

Internal links to SharePoint or OneDrive can be blocked if the domain is not recognized. The Safe Links service treats them like external URLs. To fix this, add your SharePoint domain to the allow list. For example, add yourtenant.sharepoint.com and yourtenant-my.sharepoint.com. Also verify that the link is not a sharing link with a query parameter, which can trigger the block.

Safe Links Warning Appears Only in Mobile Teams App

The mobile Teams app may show a warning even when the desktop app does not. This is because the mobile app uses a different URL preview service. The fix is the same: add the domain to the allow list. If the warning persists, clear the Teams app cache on your mobile device.

Teams Blocks a Link That Was Safe Yesterday

A domain can become flagged if Microsoft’s threat intelligence detects malicious activity on any subdomain. Check the domain reputation in the Microsoft 365 Defender portal under Threat explorer. If the domain is clean, add it to the allow list to bypass the block.

Safe Links Policy Settings vs Tenant Allow/Block List

Item	Safe Links Policy Settings	Tenant Allow/Block List
Purpose	Control how URLs are scanned and clicked	Override scan results for specific URLs or domains
Scope	Applies to all users in the policy	Applies to all users in the tenant
Effect	Can block or allow based on scan results	Forces allow or block regardless of scan
Management location	Microsoft 365 Defender > Safe Links	Microsoft 365 Defender > Tenant Allow/Block Lists
Propagation time	Up to 30 minutes	Up to 30 minutes

Now you can stop Teams from blocking a valid URL. Edit the Safe Links policy in the Microsoft 365 Defender portal, and add the domain to the tenant allow/block list if needed. After making changes, wait 30 minutes and test the link again. For a permanent fix, add your internal domains to the allow list. Use the Threat explorer to review domain reputation if the block persists.